Splunk Search

Is it possible to use fillnull for fieldnames with a specific pattern?

HeinzWaescher
Motivator

Hi,

is it possible to use fillnull for fields with a specific pattern? Wildcards are not working, but I want to avoid using fillnull for each and every field.

For example I would like to fillnull all fieldnames that contain "ABC".

Cheers
Heinz

0 Karma
1 Solution

somesoni2
Revered Legend

Try this workaround

...| foreach *ABC* [eval "<<FIELD>>"=coalesce('<<FIELD>>',"YourDefaultValueHere") ]

View solution in original post

somesoni2
Revered Legend

Try this workaround

...| foreach *ABC* [eval "<<FIELD>>"=coalesce('<<FIELD>>',"YourDefaultValueHere") ]

HeinzWaescher
Motivator

works fine, thanks a lot

0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...